Ever-growing CRL?

The problems are manyfold, but most particularly the users do not know what they're supposed to be checking - in the US every single state (50 of them) gets to have their own business rules, and their own registrations, so you need to guess the "right" state for any particular business. For very local outfits it's probably the state where you are now, but for anywhere big enough to have an actual business structure they're likely registered somewhere financially & legally beneficial, such as Delaware. So who knows

Then, brands are what you care about as a customer, but the business name isn't the brand. Maybe you know them as "Big Kahuna Burger" but if their legal business name is "Edison Restaurant Group" too bad, the paperwork does not give the burger brand name and neither does the certificate.

Also, even assuming you do care that this site is owned by the "real" Edison Restaurant Group registered in Louisiana and not the one from Texas or California, the checking was always rather flimsy, it could hardly be otherwise. Somebody is going to get a business directory, they're about as reliable as a phone book was back when those existed. They're going to check that the person who asked for a cert can (say), read a Fax they sent to the right Fax number, something like that. How the check is performed is likely to be decided by the attacker, from a menu of options. Considering how relatively worthless this is, it's not exactly a huge security hole, but keep in mind that's what we're talking about - can you trick the person on some corporate front desk into letting you steal one fax, which you know when it's coming ? Or maybe make one phone call from a corporate number ? Or maybe make a decent reproduction of their corporate headed notepaper and wear a smart suit to a lawyer's office ? Weakest link applies, often it's "forge email from the right person" these days because modern business directories list email addresses.